WordPress Vulnerability Scanner WPSec
Vulnerabilities / Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages

Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages vulnerabilities

Advisories WPSec published for Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages. Other sources may list more. Its attack surface: Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages on WPSec AttackSurface.

PublishedIDVulnerabilitySeverityFixed in
2026-10-16 WPSEC-2026-1071 Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages <= 3.4.6 - Unauthenticated Authorization Bypass via 'ck_subscriber_id' Parameter and Cookie Medium 5.3 3.4.7
2026-10-08 WPSEC-2026-0625 Kit (formerly ConvertKit) – Email Newsletter, Email Marketing, Membership, Subscribers and Landing Pages <= 3.4.5 - Authenticated (Contributor+) Missing Authorization to Kit Account Connection via OAuth Callback Medium 4.2 3.4.6

License: CC BY 4.0